CakeFuzzer

CakeFuzzer Latest release : 1.0 License : GNU GPL v3.0 Cake Fuzzer is a project that is meant to help automatically and continuously discover vulnerabilities in web applications created based on specific frameworks with very limited false positives. Currently it is implemented to support the Cake...

CVE-2026-77635

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-77635 CVE-2026-77635 CakePHP 5.2.13 — cakephp CakePHP — это фреймворк для быстрой разработки на PHP. В версиях до 5.1.10, 5.2.15 и 5.3.7 на соответствующих линиях релизов метод FunctionsBuilder::jsonValue с PostgresDriver уязвим к...

CVE-2026-79752

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-79752 CVE-2026-79752 CakePHP 5.2.13 — cakephp CakePHP — это фреймворк для быстрой разработки на PHP. До версий 4.5.12, 4.6.5, 5.1.9, 5.2.14 и 5.3.7 методы FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart ...

CVE-2026-95658

MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a...

CVE-2026-95658 MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules

MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a...

CVE-2026-95658

CVE-2026-95658 affects MISP , where the moduleStatelessExecution action in the WorkflowsController was listed in the CakePHP Security component's unlockedActions list, disabling both the CSRF token check and field hash validation . An attacker could craft a cross-site form post that, when submitt...

Exploit for CVE-2026-77635

abraxaslabs.tech · github.com/abraxas ·&...

Exploit for CVE-2026-79752

abraxaslabs.tech · github.com/abraxas ·&...

SQL Injection

CakePHP is vulnerable to SQL Injection. The vulnerability is due to insufficient validation and escaping of user-controlled dataType, part, and unit values used in generated SQL statements, which allows an attacker to inject malicious SQL queries and potentially access, modify, or delete database...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the FunctionsBuilder::cast, extract, datePart, or dateAdd methods when user-controlled input is passed to the dataType, part, or unit parameters. An attacker can execute arbitrary SQL commands by supplying crafted inpu...

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Impact The FunctionsBuilder::cast$field, $dataType, extract$part, $expr, datePart$part, $expr, dateAdd$expr, $value, $unit methods are vulnerable to SQL injection if user controlled data is supplied to the $dataType / $part / $unit parameters. Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain...

GHSA-VJQC-Q4MP-2RVF CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Impact The FunctionsBuilder::cast$field, $dataType, extract$part, $expr, datePart$part, $expr, dateAdd$expr, $value, $unit methods are vulnerable to SQL injection if user controlled data is supplied to the $dataType / $part / $unit parameters. Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain...

SQL Injection

Overview cakephp/cakephp is a rapid development framework for PHP which uses commonly known design patterns like Associative Data Mapping, Front Controller, and MVC. Affected versions of this package are vulnerable to SQL Injection via the FunctionsBuilder::cast, extract, datePart, or dateAdd...

CVE-2026-93295

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

CVE-2026-93295

MISP (Malicious Intelligence Sharing Platform) is vulnerable to remote code execution via its background job dispatch mechanism. User-controlled fields (person and message) from the events/contact endpoint are passed unvalidated into the CakePHP console process argv. An attacker sets person to a ...

CVE-2026-93295 MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

EUVD-2026-82314

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

CVE-2026-93295 MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

CVE-2026-79752

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit valu...

CVE-2026-79752

CakePHP , a rapid development framework for PHP, is affected by an SQL injection vulnerability in src/Database/FunctionsBuilder.php. The methods FunctionsBuilder::cast , ::extract , ::datePart , and ::dateAdd accept user-controlled dataType, part, or unit values and incorporate them into generate...